Compare

HIPAA vs FERPA: how they differ, side by side

How HIPAA and FERPA differ: what each is, who owes it, when it applies and who enforces it.

HIPAABinding law

FERPABinding on schools receiving U.S. Department of Education funds

Checked21 Oct 2026

01 / Side by side

HIPAA and FERPA, side by side

	HIPAA	FERPA
What it is	regulation	statute
Jurisdiction	United States (federal)	United States (federal)
Legal force	Binding law	Binding on schools receiving U.S. Department of Education funds
Status	In force	In force
Applies from	14 Apr 2003	19 Nov 1974
Who owes it	Covered entities (health plans, health care clearinghouses and providers that bill electronically) and their business associates, including AI vendors that handle protected health information for them.	Educational agencies and institutions that receive U.S. Department of Education funds, and outside parties that receive education records from them.
Enforcement	HHS Office for Civil Rights and state attorneys general. Civil penalties adjusted for inflation range from $145 to $2,190,294 per violation, with an annual cap of $2,190,294 per identical provision; knowing violations can bring DOJ criminal charges.	U.S. Department of Education Student Privacy Policy Office; the ultimate remedy is withholding federal funds after voluntary compliance fails. No private right of action (Gonzaga Univ. v. Doe, 2002).

02 / HIPAA

What HIPAA requires

HHS has stated that PHI in AI training data, prediction models and algorithm data held by a regulated entity for covered functions is protected by the HIPAA Rules. Generative AI tools that memorize or reveal training data can cause impermissible disclosures.

01Use or disclose PHI in AI tools only for a permitted purpose, such as treatment, payment or operations, or with patient authorization.
02Sign a business associate agreement before an AI vendor creates, receives, maintains or transmits PHI for you.
03Limit PHI sent to AI tools to the minimum necessary, except for treatment disclosures.
04De-identify data by Safe Harbor or Expert Determination before treating it as outside HIPAA, for example for model training.
05Get authorization or an IRB or privacy board waiver before using PHI for research, including AI research.
06Assess and notify under the Breach Notification Rule if an AI tool exposes unsecured PHI.

03 / FERPA

What FERPA requires

AI tutors, grading tools and analytics platforms that receive student records usually rely on the school-official exception, so the school must keep direct control over how the vendor uses the data. A vendor reusing records for its own purposes, such as training general models, falls outside the authorized purpose unless consent or another exception covers it.

01Get written consent before disclosing personally identifiable information from education records, unless a listed exception applies.
02Treat an AI vendor as a 'school official' only if it performs an institutional function, under direct school control over use and maintenance of records.
03Limit vendors' use and redisclosure of records to the authorized purpose (34 CFR 99.33).
04Use reasonable methods so school officials, including vendors, access only records with a legitimate educational interest.
05Publish an annual notice of rights stating the criteria for who counts as a school official and legitimate educational interest.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES